{
 "name": "Discovery and Auth-Posture Probe — AI Crawler Index",
 "description": "Name a host and it GETs the documents an agent client reads BEFORE it dials anything, then says what each one answered and what a client does with that answer: /.well-known/oauth-protected-resource in BOTH forms — the root form everyone publishes and the RFC 9728 §3.1 insertion form a spec-following client actually requests for a resource served under a path — /.well-known/oauth-authorization-server, /.well-known/mcp, /.well-known/mcp.json, /mcp.json and /llms.txt. Each result carries the status and a verdict: served, missing, gated, soft-404 (a 200 carrying an HTML error page, the failure that reads as working) or invalid JSON. GET only. This agent never speaks JSON-RPC to your endpoint and never sends a credential; it reads public documents and reports what was there. A missing document is reported as missing, never as a vulnerability. Deterministic and read-only: there is no model behind it — it reports exactly what each document answered, and the same skill is also available as an MCP tool at https://www.pathwren.workers.dev/mcp/lint. No key, no signup, no quota. Independent and unaffiliated with any operator it documents. TO CALL IT: send `message/send` (v1.0 name `SendMessage`) — the first example on every skill below is a complete request you can POST unedited, and it comes back as a Task already in state `completed` in the same response, so there is nothing to poll. Nothing to hand over? The `whoami` skill takes no arguments and answers about you. Every skill on all eight agents of this host as a ready-to-send body: https://www.pathwren.workers.dev/a2a/example.json",
 "supportedInterfaces": [
  {
   "url": "https://www.pathwren.workers.dev/a2a/discovery",
   "protocolBinding": "JSONRPC",
   "protocolVersion": "1.0"
  }
 ],
 "url": "https://www.pathwren.workers.dev/a2a/discovery",
 "preferredTransport": "JSONRPC",
 "protocolVersion": "1.0",
 "provider": {
  "organization": "Pathwren",
  "url": "https://www.pathwren.workers.dev"
 },
 "version": "1.0.0",
 "documentationUrl": "https://www.pathwren.workers.dev/a2a.html",
 "iconUrl": "https://www.pathwren.workers.dev/icon.png",
 "capabilities": {
  "streaming": false,
  "pushNotifications": false,
  "extendedAgentCard": false,
  "extensions": [
   {
    "uri": "https://www.pathwren.workers.dev/changes.json",
    "description": "Since-cursor change feed for this HOST, not for this agent. GET /changes.json?since=<cursor> returns what moved in the crawler dataset the other agents on this host answer from — this agent has no dataset behind it and nothing in that feed changes what it says about the endpoint you name it, so poll it only if you also use those. It is listed here because the MCP twin of this agent publishes the same feed as a resource, and a card that hid what its own server offers would be the two lanes disagreeing. There is no changes_since skill on this agent.",
    "required": false,
    "params": {
     "cursorParameter": "since",
     "transport": "https-get",
     "minPollSeconds": 21600,
     "describesThisAgent": false,
     "alsoAnMcpResourceOn": "https://www.pathwren.workers.devmcp_lint.js"
    }
   },
   {
    "uri": "https://www.pathwren.workers.dev/mcp/lint",
    "description": "THE SAME AGENT ON THE OTHER PROTOCOL. Every skill on this card is also a tool on an MCP (Model Context Protocol) server at https://www.pathwren.workers.dev/mcp/lint — same name, same arguments, same answer, because one function answers both doors and a deploy that let them drift is refused. JSON-RPC 2.0 over a single HTTP POST: no session to open, no SSE stream to hold, no key, no signup, no quota. If your runtime speaks MCP rather than A2A, add that URL as a server and you have everything on this card without writing an A2A client. `params.initialize` and `params.callATool` are COMPLETE request bodies — POST either one unedited and it answers; `params.curl` is the same thing as one line. The tool named `example` takes no arguments at all and runs this server's own worked example end to end, so the first call needs nothing you do not already have. That server also carries tools this agent does not: they belong to the sibling agents listed in `params.siblingSkillsOnThatServer`, each with its own card and its own URL. Send one of them here and you get a 307 to the agent that performs it, never an invented answer.",
    "required": false,
    "params": {
     "protocol": "MCP (Model Context Protocol)",
     "endpoint": "https://www.pathwren.workers.dev/mcp/lint",
     "transport": "streamable-http (JSON-RPC 2.0 in one HTTP POST; the response is JSON, not a stream)",
     "protocolVersions": [
      "2026-07-28",
      "2025-11-25",
      "2025-06-18",
      "2025-03-26",
      "2024-11-05"
     ],
     "authentication": "none",
     "a2aTwin": "https://www.pathwren.workers.dev/a2a/discovery",
     "toolNamesEqualSkillIds": false,
     "everySkillOnThisCardIsAToolThere": true,
     "siblingSkillsOnThatServer": {
      "handshake_report": "https://www.pathwren.workers.dev/a2a/lint",
      "tools_list_report": "https://www.pathwren.workers.dev/a2a/lint",
      "error_conformance": "https://www.pathwren.workers.dev/a2a/lint",
      "score_card": "https://www.pathwren.workers.dev/a2a/score"
     },
     "sameImplementation": "Each skill on this card and the tool of the same name on that server are answered by one function; the deploy gate compares them skill by skill.",
     "initialize": {
      "jsonrpc": "2.0",
      "id": 1,
      "method": "initialize",
      "params": {
       "protocolVersion": "2026-07-28",
       "capabilities": {},
       "clientInfo": {
        "name": "example-client",
        "version": "1.0.0"
       }
      }
     },
     "callATool": {
      "jsonrpc": "2.0",
      "id": 2,
      "method": "tools/call",
      "params": {
       "name": "example",
       "arguments": {}
      }
     },
     "curl": "curl -s https://www.pathwren.workers.dev/mcp/lint -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"example\",\"arguments\":{}}}'",
     "everyToolAsABody": "https://www.pathwren.workers.dev/tools/",
     "discovery": "https://www.pathwren.workers.dev/.well-known/mcp.json"
    }
   }
  ]
 },
 "defaultInputModes": [
  "application/json",
  "text/plain"
 ],
 "defaultOutputModes": [
  "application/json",
  "text/plain"
 ],
 "skills": [
  {
   "id": "discovery_report",
   "name": "What a client looks for before it dials",
   "description": "GET the documents an MCP client reads BEFORE the handshake and report what each one answered: /.well-known/oauth-protected-resource in BOTH forms — the root form everyone publishes and the RFC 9728 §3.1 insertion form a spec-following client actually requests for a resource served under a path — /.well-known/oauth-authorization-server, /.well-known/mcp, /.well-known/mcp.json, /mcp.json and /llms.txt. Each result carries the status, the verdict (served, missing, gated, soft-404 — a 200 carrying an HTML error page — or invalid JSON) and what a client does with that document. Makes one GET per document, 6 s each. Example: host='mcp.example.com' or host='https://mcp.example.com/mcp' (a path turns on the RFC 9728 insertion-form check) — or {} for the built-in fixture.",
   "tags": [
    "well-known",
    "oauth",
    "discovery",
    "auth posture"
   ],
   "examples": [
    "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"message/send\",\"params\":{\"message\":{\"role\":\"ROLE_USER\",\"messageId\":\"1\",\"parts\":[{\"text\":\"{\\\"skill\\\":\\\"discovery_report\\\"}\"}]}}}",
    "{\"skill\":\"discovery_report\"}",
    "discovery_report mcp.example.com"
   ],
   "inputModes": [
    "application/json",
    "text/plain"
   ],
   "outputModes": [
    "application/json",
    "text/plain"
   ]
  },
  {
   "id": "whoami",
   "name": "Who is calling? (no arguments)",
   "description": "Takes no arguments. Safe to call. Deterministic. Touches no third party. Classifies the request you just sent: the user-agent you claim, the address you came from, the class this host's own instrument books you as, whether we have seen you here before and what you fetched, and what this host's robots policy says about you. Every fact comes from the headers on your own request or from a file this host already publishes — nothing is fetched, nothing about you is invented, no argument exists. Example: arguments={} returns your user-agent, your address, the class we book you as and whether we have seen you here before.",
   "tags": [
    "identify",
    "no arguments",
    "diagnostics",
    "user-agent"
   ],
   "examples": [
    "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"message/send\",\"params\":{\"message\":{\"role\":\"ROLE_USER\",\"messageId\":\"1\",\"parts\":[{\"text\":\"{\\\"skill\\\":\\\"whoami\\\"}\"}]}}}",
    "{\"skill\":\"whoami\"}",
    "whoami",
    "who am i to you"
   ],
   "inputModes": [
    "application/json",
    "text/plain"
   ],
   "outputModes": [
    "application/json",
    "text/plain"
   ]
  },
  {
   "id": "example",
   "name": "Run this server's worked example (no arguments)",
   "description": "Takes no arguments. Safe to call. Deterministic. Touches no third party. Runs this server's own worked example end to end — one of its real tools, on a canned input taken from this host's own published data — and returns exactly the structuredContent a real call returns, not a mock and not a description of one. Use it to see the shape of an answer before you decide what to send. No URL of yours is fetched and no third party is touched. Example: arguments={} runs it and returns the real answer.",
   "tags": [
    "example",
    "no arguments",
    "demo",
    "getting started"
   ],
   "examples": [
    "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"message/send\",\"params\":{\"message\":{\"role\":\"ROLE_USER\",\"messageId\":\"1\",\"parts\":[{\"text\":\"{\\\"skill\\\":\\\"example\\\"}\"}]}}}",
    "{\"skill\":\"example\"}",
    "example",
    "show me a worked example"
   ],
   "inputModes": [
    "application/json",
    "text/plain"
   ],
   "outputModes": [
    "application/json",
    "text/plain"
   ]
  }
 ]
}